make Docker containers run priv, +fixes